Cybercrime and hacking cost untold millions of dollars and cause great damage to organizations and individuals. Internet domains (such as google.com or nasa.gov) are used by legitimate organizations and individuals, but domains also can be, and are, registered for illicit purposes quite frequently.
Thousands of malicious domains (relating to spam, phishing, botnet, malware, etc) are created and registered every day. Users and assets have a need to be protected from these domains from their inception. This protection instituted must be automated and scalable because humans cannot possibly intervene at the speed and scale of even the smallest organization's Internet usage. Without an automated system, implemented as part of a firewall or similar system, organizations are exposed to dangerous domains numerous times a day.
There are applications for such a technology that also work at “human speed.” Presently, individuals charged with the task of evaluating domains for risk (such as for proposed e-commerce) need a means of quickly assessing the supplicant domain. Banks are known to commonly face such situations daily.                Computer emergency response teams (CERTs) see large numbers of domains in alerts and logs raised by the systems they monitor. In order to work efficiently, and not to be inundated with data to the point of paralysis, they need a reliable way to sort and filter domains based on the level of risk those domains pose to the organization being defended.        Law enforcement, government agencies, and other cybercrime investigators need reliable means of assessing the risk of domains they are investigating.        
The problem with traditional reputation scoring and blacklisting lies in the delay imposed between domain registration and inception, and detection/flagging of the malicious domain as malicious. Minimizing this delay is key to reducing the damage caused by newly registered malicious domains. There are many reputation scoring systems already in existence. These systems use a variety of methods—some automated, some manual—to assign risk scores to domains. In so doing, they play a valuable role in the fight against cybercrime, hacking, cyberwarfare, etc. However, the common element in existing reputation scoring systems is that they rely on the observation of malicious (or suspicious) activity occurring on domains in order to assign risk scores or place domains on blacklists. This means that there is always at least one—but in practice, typically many more than one—victim that suffers damage from the domain before the domain is properly categorized or “flagged” as malicious, allowing security systems to defend other users from the malicious domain. Because this is a continuous cycle of activity, multitudes of users around the world are harmed by domains that have not been flagged by traditional reputation scoring mechanisms.
Thus, there is a need for a new predictive scoring system configured to expeditiously identify, flag, and address malicious, malware-inducing, or otherwise dangerous domains registered, that employs up-to-date domain and registrant database information to generate a risk score for each domain in existence. Such a system would preferably begin detection of such malicious domains from their inception, and would employ predictive and associative algorithms to potentially flag a malicious domain before damage occurs.
Unlike traditional reputation scoring mechanisms, the system of the present invention generates a Proximity Score that does not rely on the observation of malicious activity in order to assign scores. Rather, it calculates risk based on properties that are with a domain from its inception (in fact, these properties exist before the domain's inception, and the domain inherits them when it is registered and placed online). Thus, the system of the present invention calculates risk based on these properties, and assigns a calculated score as soon as the system is aware of the domain.
Other entities have attempted to craft a similar scoring system to that of the present invention. OpenDNS (www.opendns.com) has developed a predictive URL reputation score that looks, in certain ways, similar to the system of the present invention. However, its features and its underlying technologies differ from those of the present invention. OpenDNS makes use of an algorithm that evaluates whether a domain name was likely generated automatically (by a so-called Domain Generation Algorithm, or DGA), and looks at the IP address connected to the URL. The OpenDNS system does not take domain registrant information into account, and the registrant is one of the strongest connectors between domains. Unfortunately, the OpenDNS system also lacks the comprehensive domain registration database of the present invention.